Pith. sign in

REVIEW 1 major objections 1 minor 44 references

Network taps on every wire plus a Secure Gateway Device let auditors commit and later verify all AI cluster I/O without any processor trusted by both sides.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.3

2026-06-27 12:27 UTC pith:HO6BEX54

load-bearing objection The paper sketches a passive-tap plus gateway architecture for committing all AI cluster I/O without shared-trust processors, but the side-channel erasure claims rest on an underspecified device. the 1 major comments →

arxiv 2606.10724 v1 pith:HO6BEX54 submitted 2026-06-09 cs.CR

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

Naci Cankaya , Jakub Kry\'s , Jonathan Ng , Luke Marks , Felix Kr\"uckel This is my paper
classification cs.CR
keywords AI cluster verificationcryptographic commitmentnetwork tapssecure gateway devicecovert channel erasureoptical splittersside-channel mitigationcompliance auditing
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out a hardware architecture that places passive network taps on all fibres leaving or entering an AI data centre and computes cryptographic hashes of the traffic. These hashes allow an auditor to demand the original data later for privacy-preserving compliance checks at a separate facility. A Secure Gateway Device sits in the path to erase analogue side-channels, timing channels, and protocol-header steganography that the hashes alone cannot catch. The design deliberately avoids any processor that both the cluster operator and the auditor must trust, substituting passive optical splitters and coin-flip randomness protocols instead. If the gateway performs as specified, covert exfiltration of undisclosed workloads through the tapped links becomes infeasible.

Core claim

Hashes computed at network taps on every external wire create a cryptographic commitment to all cluster I/O; a Secure Gateway Device placed between the cluster and the taps erases analogue and timing side-channels plus steganography in headers, and the device is constructed from passive optical fibre splitters and coin-flip protocols so that no processor needs to be trusted by both the prover and the verifier.

What carries the argument

The Secure Gateway Device, which erases covert channels that post-hoc hash verification cannot address by using passive optical fibre splitters and coin-flip protocols for randomness.

Load-bearing premise

The Secure Gateway Device can reliably erase analogue and timing side-channels as well as steganography in network protocol headers.

What would settle it

Demonstration that data can still be exfiltrated through an analogue, timing, or header channel that survives the gateway while the corresponding hashes remain consistent with the claimed preimage.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • An auditor can later challenge any hash to obtain the original packets for compliance inspection without prior disclosure.
  • Covert exfiltration of results from undisclosed workloads through the monitored wires becomes infeasible.
  • Verification infrastructure for potential international AI agreements can be built without mutual hardware trust.
  • A working demonstration device has an expected bill of materials and engineering effort comparable to a small team for a few months.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same tap-and-gateway pattern could be applied to other regulated high-performance computing facilities where side-channel leakage is a concern.
  • Once deployed, the hashes create a permanent, queryable record that could support statistical audits of total compute usage over time.
  • If the gateway must be physically co-located with the cluster, physical security of the gateway itself becomes the new single point of trust.
  • The coin-flip protocols for randomness may introduce latency or bandwidth limits that affect the maximum sustainable I/O rate.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

1 major / 1 minor

Summary. The paper proposes a method to cryptographically commit all I/O of an AI cluster by placing network taps on all external wires to compute hashes of traffic, enabling retroactive challenges of preimages at a privacy-preserving verification facility. A Secure Gateway Device is specified to erase covert channels (analogue/timing side-channels and header steganography) that post-hash verification cannot address, using only passive optical fibre splitters and coin-flip protocols for randomness, thereby eliminating any need for processors trusted by both prover and verifier.

Significance. If the no-mutual-trust claim holds, the architecture would enable low-trust verification infrastructure for AI data centres, supporting potential international compliance agreements with modest development costs. The emphasis on passive components and avoidance of shared trusted hardware is a notable strength if the side-channel erasure can be shown to work without active trusted logic.

major comments (1)
  1. [Secure Gateway Device architecture] Secure Gateway Device section: the claim that passive optical splitters plus coin-flip protocols suffice to erase analogue leakage, timing jitter, and header steganography is load-bearing for the central no-mutual-trust guarantee, yet the architecture description provides no concrete mechanism (e.g., how buffering, reshaping, or deterministic header rewriting occurs without stateful active components whose integrity both parties must trust). Post-hoc hash verification only catches content exfiltration; any residual covert channel defeats the fingerprinting guarantee.
minor comments (1)
  1. The expected development cost estimate (small team for a few months) is stated without a bill-of-materials breakdown or component list that would allow independent assessment of feasibility.

Simulated Author's Rebuttal

1 responses · 0 unresolved

We thank the referee for their careful reading and for identifying the need for greater specificity in the Secure Gateway Device description. The no-mutual-trust property is indeed central, and we agree that the current architecture section would benefit from additional concrete mechanisms. We address the comment below and will revise accordingly.

read point-by-point responses

  1. Referee: [Secure Gateway Device architecture] Secure Gateway Device section: the claim that passive optical splitters plus coin-flip protocols suffice to erase analogue leakage, timing jitter, and header steganography is load-bearing for the central no-mutual-trust guarantee, yet the architecture description provides no concrete mechanism (e.g., how buffering, reshaping, or deterministic header rewriting occurs without stateful active components whose integrity both parties must trust). Post-hoc hash verification only catches content exfiltration; any residual covert channel defeats the fingerprinting guarantee.

    Authors: We agree that the mechanisms must be specified more concretely to substantiate the claim. In revision we will expand the Secure Gateway Device section with explicit designs that rely exclusively on passive optical components and local coin-flip randomness: (1) analogue leakage is erased by fixed optical attenuators and bandpass filters placed after the splitter to normalize power levels and remove amplitude modulation; (2) timing jitter and buffering are handled by fixed-length optical delay lines combined with coin-flip-generated random padding frames that are inserted and later stripped deterministically at the verifier side using the same public coin-flip seed; (3) header steganography is eliminated by a passive optical header-rewriting stage that overwrites selected fields with values derived from the coin-flip stream before the traffic reaches the external link. Because all randomness is generated locally via coin-flip protocols and no state is shared or trusted across parties, the design preserves the no-mutual-trust guarantee. These additions will be accompanied by a diagram and a short security argument showing that residual channels are reduced to levels below the hash-verification threshold. revision: yes

Circularity Check

0 steps flagged

No circularity: architectural proposal with no derivations or fitted claims

full rationale

The manuscript is an engineering architecture proposal for a Secure Gateway Device that uses passive optical splitters and coin-flip protocols. No equations, parameter fits, derivation chains, or uniqueness theorems appear in the abstract or described claims. The central assertion (elimination of mutually trusted processors) is presented as a design choice supported by component properties rather than any self-referential reduction or renamed input. No load-bearing steps reduce to the paper's own outputs by construction.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 1 invented entities

The central claim rests on the feasibility of the invented Secure Gateway Device to handle covert channels that hashes cannot address; this is postulated without independent evidence in the abstract.

axioms (1)
  • domain assumption Passive optical fibre splitters can provide the necessary tapping without introducing active trusted components.
    The architecture relies on this to avoid trusted processors.
invented entities (1)
  • Secure Gateway Device no independent evidence
    purpose: Handles erasure of covert channels (analogue, timing side-channels, steganography) that hashed data verification cannot address.
    New component proposed to complete the system.

pith-pipeline@v0.9.1-grok · 5747 in / 1270 out tokens · 26041 ms · 2026-06-27T12:27:07.222033+00:00 · methodology

0 comments
read the original abstract

In preparation for potential international agreements on artificial intelligence, the development of verification infrastructure for AI data centres is vital. We propose a method for cryptographically committing all information entering and leaving a data centre: Hashes are computed by network taps placed on all the information-carrying wires between the cluster and the outside world, enabling an auditor to retroactively challenge the preimage data to be sent to a privacy-preserving verification facility performing compliance checks. Our goal is to make it infeasible to covertly exfiltrate the results of undisclosed workloads in the cluster through the tapped wires. To this end, we specify the architecture of a ``Secure Gateway Device'', which handles the erasure of covert channels that post-hoc verification on hashed data cannot address: analogue and timing side-channels, as well as steganography in network protocol headers. The architecture eliminates the need for any processors trusted by both the Prover and the Verifier, leveraging passive optical fibre splitters and coin-flip protocols for random number generation where needed. We expect development costs of a demonstration device to be roughly equivalent to the cost of a small team of engineers for a few months, with a comparatively small bill of materials.

Figures

Figures reproduced from arXiv: 2606.10724 by Felix Kr\"uckel, Jakub Kry\'s, Jonathan Ng, Luke Marks, Naci Cankaya.

Figure 1
Figure 1. Figure 1: A breakdown of the AI Verification research agenda into its goals and subgoals. Original from Baker et al. (2025) with the authors’ permission. In this work, we focus on verification Subgoals 1A and 2A. In this work, our main focus are Subgoals 1A and 2A of Baker et al. (2025), which can be summarised as follows: an entity operating a computing cluster — the Prover — aims to prove to the auditing party — t… view at source ↗
Figure 2
Figure 2. Figure 2: We are specifically aiming for Level 2: capturing and safely transmitting raw evidence of computation (only hashes, not plaintext). The hashes, together with the plaintext data they point to, later feed into a secure cluster trusted by the Verifier, without the plaintext information being shown to them directly. Out of scope. In order to convey the nuance of the prob￾lems we are — and are not — tackling, w… view at source ↗
Figure 3
Figure 3. Figure 3: The placement and main task of the SeGaDev. Here, it is shown as an interceptor between TLS termination point (encryption boundary) and the data centre fabric routing traffic to individual compute units. This placement is not the only option: one could also place network taps between the edge router(s) and the compute units, at any level of the north-south network hierarchy. The general principle is that a… view at source ↗
Figure 4
Figure 4. Figure 4: When north-south egress traffic from the data centre hits the SeGaDev, we first scrub non-reproducible fields with an Active Warden. Where necessary, we use a coin flip protocol as a source of randomness. Traffic leaving the Active Warden is hashed and forwarded. Components drawn in orange represent components that the Verifier relies on to behave correctly, and components drawn in blue represent the same … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

44 extracted references · 6 canonical work pages · 2 internal anchors

  1. [1]

    2026 , month = feb, howpublished =

    Bengio, Yoshua and others , title =. 2026 , month = feb, howpublished =

    2026

  2. [2]

    Interim Measures for the Management of Generative Artificial Intelligence Services , year =

  3. [3]

    2024 , month = jul, howpublished =

    Regulation (. 2024 , month = jul, howpublished =

    2024

  4. [4]

    2025 , month = sep, howpublished =

    Wiener, Scott , title =. 2025 , month = sep, howpublished =

    2025

  5. [5]

    2025 , howpublished =

    Global Call for. 2025 , howpublished =

    2025

  6. [6]

    Computing power and the governance of artificial intelligence

    Sastry, Girish and Heim, Lennart and Belfield, Haydn and Anderljung, Markus and Brundage, Miles and Hazell, Julian and O'Keefe, Cullen and Hadfield, Gillian K. and Ngo, Richard and Pilz, Konstantin and Gor, George and Bluemke, Emma and Shoker, Sarah and Egan, Janet and Trager, Robert F. and Avin, Shahar and Weller, Adrian and Bengio, Yoshua and Coyle, Dia...

    work page arXiv 2024

  7. [7]

    2021 , month = mar, url =

    Final Report of the National Security Commission on Artificial Intelligence , institution =. 2021 , month = mar, url =

    2021

  8. [8]

    2025 , howpublished =

    Petrie, James and Aarne, Onni , title =. 2025 , howpublished =

    2025

  9. [9]

    2024 , howpublished =

    Scher, Aaron and Thiergart, Lisa , title =. 2024 , howpublished =

    2024

  10. [10]

    2025 , month = jul, url =

    Harack, Benjamin and others , title =. 2025 , month = jul, url =

    2025

  11. [11]

    Verifying international agreements on AI : Six layers of verification for rules on large-scale AI development and deployment

    Baker, Mauricio and Kulp, Gabriel and Marks, Oliver and Brundage, Miles and Heim, Lennart , title =. 2025 , journal =. 2507.15916 , archivePrefix=

    work page arXiv 2025

  12. [12]

    2024 , month = jan, url =

    Aarne, Onni and Fist, Tim and Withers, Caleb , title =. 2024 , month = jan, url =

    2024

  13. [13]

    ICML 2025 Workshop on Technical AI Governance (TAIG) , year =

    Petrie, James , title =. ICML 2025 Workshop on Technical AI Governance (TAIG) , year =

    2025

  14. [14]

    2026 , howpublished =

    Happel, Jesse , title =. 2026 , howpublished =

    2026

  15. [15]

    Lee, Ki Suh and Wang, Han and Weatherspoon, Hakim , title =. 11th. 2014 , url =

    2014

  16. [16]

    and Dakhane, Dhiraj M

    Uttarwar, Vaibhav U. and Dakhane, Dhiraj M. , title =. EPJ Web of Conferences , publisher =. 2025 , volume =

    2025

  17. [17]

    Telecommunication Systems , volume =

    Jankowski, Bart. Telecommunication Systems , volume =. 2013 , doi =

    2013

  18. [18]

    , title =

    Simmons, Gustavus J. , title =. Advances in Cryptology: Proceedings of. 1984 , doi =

    1984

  19. [19]

    Information Hiding (

    Fisk, Gina and Fisk, Mike and Papadopoulos, Christos and Neil, Joshua , title =. Information Hiding (. 2003 , doi =

    2003

  20. [20]

    Xing, Jiarong and Kang, Qiao and Chen, Ang , title =. 29th. 2020 , url =

    2020

  21. [21]

    2025 , journal =

    Karvonen, Adam and Reuter, Dylan and Rinberg, Ravi and Marks, Luke and Garriga-Alonso, Adri. 2025 , journal =. 2511.20621 , archivePrefix=

    work page arXiv 2025

  22. [22]

    Cankaya, Naci , title =

  23. [23]

    2025 , journal =

    Rinberg, Ravi and Karvonen, Adam and Hoover, Aidan and Reuter, Dylan and Warr, Kellin , title =. 2025 , journal =. 2511.02620 , archivePrefix=

    work page arXiv 2025

  24. [24]

    2024 , howpublished =

    2024

  25. [25]

    2023 , howpublished =

    2023

  26. [26]

    2017 , month = oct, day =

    Rule 613 (. 2017 , month = oct, day =

    2017

  27. [27]

    2018 , month = may, day =

    A Ticking Clock: The Tricky Issue of Timestamping for. 2018 , month = may, day =

    2018

  28. [28]

    2019 , month = mar, url =

    An Overview of. 2019 , month = mar, url =

    2019

  29. [29]

    2020 , month = oct, url =

    2020

  30. [30]

    2013 , month = jul, day =

    2013

  31. [31]

    Sensors , volume =

    Park, Jangyong and Yoo, Jaehoon and Yu, Jaehyun and Lee, Jiho and Song, JaeSeung , title =. Sensors , volume =. 2023 , month = mar, doi =

    2023

  32. [32]

    2026 , month = jan, note =

    Cankaya, Naci , title =. 2026 , month = jan, note =

    2026

  33. [33]

    Accurate Models of NVIDIA Tensor Cores

    Khattak, Faraz Ahmad and Mikaitis, Mantas , title =. 2025 , month = dec, journal =. 2512.07004 , archivePrefix=

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  34. [34]

    The Llama 3 Herd of Models

    Dubey, Abhimanyu and others , title =. 2024 , month = jul, journal =. 2407.21783 , archivePrefix=

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  35. [35]

    Proceedings of the Conference of the

    Yap, Kok-Kiong and Motiwala, Murtaza and Rahe, Jeremy and Padgett, Steve and Holliman, Matthew and Baldus, Gary and Hines, Marcus and Kim, Taeeun and Narayanan, Ashok and Jain, Ankur and Lin, Victor and Rice, Colin and Rogan, Brian and Singh, Arjun and Tanaka, Bert and Verma, Manish and Sood, Puneet and Tariq, Mukarram and Tierney, Matt and Trumic, Dzevad...

    2017

  36. [36]

    IEEE Transactions on Dependable and Secure Computing , volume =

    Guri, Mordechai , title =. IEEE Transactions on Dependable and Secure Computing , volume =. 2024 , month = jul, doi =

    2024

  37. [37]

    and Petitcolas, Fabien A

    Anderson, Ross J. and Petitcolas, Fabien A. P. , title =. 1998 , month = may, doi =

    1998

  38. [38]

    2025 , month = may, day =

    Douthat, Ross , title =. 2025 , month = may, day =

    2025

  39. [39]

    2026 , month = apr, url =

    2026

  40. [40]

    Defeating Nondeterminism in

    He, Horace and. Defeating Nondeterminism in. 2025 , month = sep, day =

    2025

  41. [41]

    2025 , institution =

    Verifiable Semiconductor Manufacturing , author =. 2025 , institution =

    2025

  42. [42]

    2026 , url =

    Chat Completions streaming events , howpublished =. 2026 , url =

    2026

  43. [43]

    2026 , month =

    Ilhan, Aytunc and Withers, Caleb and Gietz, Harrison and Harack, Ben , title =. 2026 , month =

    2026

  44. [44]

    2026 , month = may, url =

    Tlaie Boria, Alejandro , title =. 2026 , month = may, url =

    2026